@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/migrations/taskSchemaMigrations.js

@@ -534,6 +534,7 @@ export function ensureWorkspaceSchema(db) {
             user_id TEXT NOT NULL,
             name TEXT NOT NULL,
             scopes_json TEXT NOT NULL,
+            tool_profile TEXT NOT NULL DEFAULT 'default',
             token_prefix TEXT NOT NULL,
             token_hash TEXT NOT NULL,
             status TEXT NOT NULL DEFAULT 'active',
@@ -654,6 +655,7 @@ export function ensureWorkspaceSchema(db) {
             { name: 'user_id', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN user_id TEXT NOT NULL DEFAULT ''` },
             { name: 'name', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN name TEXT NOT NULL DEFAULT ''` },
             { name: 'scopes_json', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN scopes_json TEXT NOT NULL DEFAULT '[]'` },
+            { name: 'tool_profile', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN tool_profile TEXT NOT NULL DEFAULT 'default'` },
             { name: 'token_prefix', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN token_prefix TEXT NOT NULL DEFAULT ''` },
             { name: 'token_hash', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN token_hash TEXT NOT NULL DEFAULT ''` },
             { name: 'status', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN status TEXT NOT NULL DEFAULT 'active'` },
@@ -1688,6 +1690,9 @@ export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
         CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_expiry
         ON workspace_sync_repair_snapshots(tenant_id, workspace_id, expires_at);
 
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_global_expiry
+        ON workspace_sync_repair_snapshots(tenant_id, expires_at, workspace_id, snapshot_id);
+
         CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_created
         ON workspace_sync_repair_snapshots(tenant_id, workspace_id, created_at);
 
@@ -1730,6 +1735,60 @@ export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
 }
 export function ensureWorkspaceSyncDurabilitySchema(db) {
     db.exec(buildWorkspaceSyncDurabilitySchemaSql(db.provider));
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_tombstone_provenance (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            kind TEXT NOT NULL,
+            logical_path TEXT NOT NULL,
+            source TEXT NOT NULL,
+            operation_id TEXT,
+            actor_id TEXT,
+            source_runtime TEXT,
+            source_updated_at TEXT NOT NULL,
+            repair_involved INTEGER NOT NULL DEFAULT 0,
+            recorded_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_tombstone_provenance_path
+        ON workspace_sync_content_tombstone_provenance(
+            tenant_id, workspace_id, kind, logical_path, recorded_at
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_tombstone_provenance_recorded
+        ON workspace_sync_content_tombstone_provenance(tenant_id, workspace_id, recorded_at);
+    `);
+    // workspace_sync_content_pull_obligations (T-1607) is normally created by
+    // ensureLocalSyncCoordinatorSchema, but that function only runs for
+    // runtimeMode === 'local' (see core/Taskforce.ts). Cloud/Postgres deployments
+    // otherwise depended solely on the static migrations/postgres/001_init.sql
+    // bootstrap, which only benefits brand-new databases — an existing cloud
+    // deployment provisioned before that table existed would never self-heal.
+    // ensureWorkspaceSyncDurabilitySchema runs unconditionally on every startup
+    // for both runtimes, so creating it here too (idempotently) closes that gap
+    // for already-provisioned cloud deployments as well.
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_pull_obligations (
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            kind TEXT NOT NULL,
+            path TEXT NOT NULL,
+            source_watermark TEXT NOT NULL,
+            metadata_fingerprint TEXT NOT NULL,
+            expected_sha256 TEXT NOT NULL,
+            expected_size_bytes INTEGER NOT NULL,
+            manifest_updated_at TEXT NOT NULL,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            last_error TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            resolved_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, kind, path)
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_pull_obligations_open
+        ON workspace_sync_content_pull_obligations(
+            tenant_id, workspace_id, resolved_at, updated_at, kind, path
+        );
+    `);
     if (db.provider === 'sqlite' && hasTable(db, 'tasks')) {
         db.exec(`
             CREATE TRIGGER IF NOT EXISTS trg_tasks_v3_create_fence
@@ -2076,6 +2135,7 @@ export function ensureLocalSyncCoordinatorSchema(db) {
             upstream_disposition TEXT NOT NULL,
             last_committed_cursor_json TEXT,
             required_action TEXT NOT NULL,
+            coalescing_key TEXT,
             created_at TEXT NOT NULL,
             resolved_at TEXT,
             resolved_boundary_json TEXT
@@ -2292,6 +2352,17 @@ export function ensureLocalSyncCoordinatorSchema(db) {
             ADD COLUMN resolved_boundary_json TEXT
         `);
     }
+    if (!recoveryObligationColumns.has('coalescing_key')) {
+        db.exec(`
+            ALTER TABLE local_sync_recovery_obligations
+            ADD COLUMN coalescing_key TEXT
+        `);
+    }
+    db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_local_sync_recovery_obligations_open_key
+        ON local_sync_recovery_obligations(coalescing_key)
+        WHERE coalescing_key IS NOT NULL AND resolved_at IS NULL
+    `);
 }
 export function ensureWorkspaceDocumentsSchema(db) {
     db.exec(`
@@ -2425,6 +2496,350 @@ export function ensureTaskforceAgentsSchema(db) {
             : `ALTER TABLE agent_conversations ADD COLUMN task_id TEXT`);
     }
 }
+export function ensureModelProviderConnectionsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS model_provider_connections (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            owner_user_id TEXT NOT NULL,
+            provider_key TEXT NOT NULL,
+            authentication_type TEXT NOT NULL,
+            lifecycle_status TEXT NOT NULL DEFAULT 'pending',
+            display_metadata_json TEXT NOT NULL DEFAULT '{}',
+            credential_home_ref TEXT NOT NULL,
+            last_verified_at TEXT,
+            last_refreshed_at TEXT,
+            last_failure_at TEXT,
+            failure_code TEXT,
+            disconnected_at TEXT,
+            revoked_at TEXT,
+            revoked_by_user_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, credential_home_ref),
+            FOREIGN KEY (owner_user_id) REFERENCES users(id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_model_provider_connections_owner
+        ON model_provider_connections(tenant_id, owner_user_id, lifecycle_status, updated_at);
+
+        CREATE TABLE IF NOT EXISTS model_provider_connection_leases (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            connection_id TEXT NOT NULL,
+            lease_token TEXT NOT NULL,
+            operation TEXT NOT NULL,
+            acquired_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, connection_id),
+            FOREIGN KEY (connection_id) REFERENCES model_provider_connections(id) ON DELETE CASCADE
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_model_provider_connection_leases_expiry
+        ON model_provider_connection_leases(tenant_id, expires_at);
+
+        CREATE TABLE IF NOT EXISTS model_provider_connection_events (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            connection_id TEXT NOT NULL,
+            owner_user_id TEXT NOT NULL,
+            actor_user_id TEXT NOT NULL,
+            event_type TEXT NOT NULL,
+            outcome TEXT NOT NULL,
+            reason_code TEXT,
+            created_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_model_provider_connection_events_connection
+        ON model_provider_connection_events(tenant_id, connection_id, created_at);
+    `);
+}
+export function ensureTaskforceAgentConnectionBindingsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS taskforce_agent_connection_bindings (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            agent_id TEXT NOT NULL,
+            connection_id TEXT NOT NULL,
+            owner_user_id TEXT NOT NULL,
+            provider_key TEXT NOT NULL,
+            model_source TEXT NOT NULL,
+            created_by_user_id TEXT NOT NULL,
+            updated_by_user_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, agent_id),
+            FOREIGN KEY (agent_id) REFERENCES taskforce_agents(id) ON DELETE CASCADE,
+            FOREIGN KEY (connection_id) REFERENCES model_provider_connections(id) ON DELETE CASCADE
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_connection_bindings_owner
+        ON taskforce_agent_connection_bindings(
+            tenant_id, workspace_id, owner_user_id, updated_at
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_connection_bindings_connection
+        ON taskforce_agent_connection_bindings(tenant_id, connection_id);
+    `);
+}
+export function ensureGitHubReviewEvidenceInstallationBindingsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS github_review_evidence_installation_bindings (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            installation_id TEXT NOT NULL,
+            account_id TEXT NOT NULL,
+            account_login TEXT NOT NULL,
+            account_type TEXT NOT NULL,
+            repository_selection TEXT NOT NULL,
+            bound_by_user_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id),
+            UNIQUE (installation_id),
+            FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_github_review_evidence_installation
+        ON github_review_evidence_installation_bindings(tenant_id, installation_id);
+    `);
+}
+export function ensureExecutorPhaseAApprovalReceiptsSchema(db) {
+    const bytesType = db.provider === 'postgres' ? 'BYTEA' : 'BLOB';
+    if (hasTable(db, 'executor_phase_a_approval_receipts')) {
+        if (db.provider === 'postgres') {
+            db.exec(`
+                ALTER TABLE executor_phase_a_approval_receipts
+                    ADD COLUMN IF NOT EXISTS receipt_kind TEXT,
+                    ADD COLUMN IF NOT EXISTS original_capability_id TEXT,
+                    ADD COLUMN IF NOT EXISTS residual_inventory_sha256 TEXT;
+                UPDATE executor_phase_a_approval_receipts
+                SET receipt_kind = 'main'
+                WHERE receipt_kind IS NULL;
+                ALTER TABLE executor_phase_a_approval_receipts
+                    ALTER COLUMN receipt_kind SET NOT NULL;
+                DO $$
+                BEGIN
+                    IF NOT EXISTS (
+                        SELECT 1 FROM pg_constraint
+                        WHERE conrelid = 'executor_phase_a_approval_receipts'::regclass
+                          AND conname = 'executor_phase_a_approval_receipts_kind_check'
+                    ) THEN
+                        ALTER TABLE executor_phase_a_approval_receipts
+                            ADD CONSTRAINT executor_phase_a_approval_receipts_kind_check
+                            CHECK (receipt_kind IN ('main', 'cleanup-only'));
+                    END IF;
+                END $$;
+            `);
+            const legacyConstraints = db.prepare(`
+                SELECT constraint_name AS name
+                FROM information_schema.table_constraints
+                WHERE table_schema = current_schema()
+                  AND table_name = 'executor_phase_a_approval_receipts'
+                  AND constraint_type = 'UNIQUE'
+            `).all();
+            for (const constraint of legacyConstraints) {
+                const name = String(constraint.name || '');
+                if (!/^[A-Za-z0-9_]+$/.test(name))
+                    continue;
+                const columns = db.prepare(`
+                    SELECT column_name AS name
+                    FROM information_schema.key_column_usage
+                    WHERE table_schema = current_schema()
+                      AND table_name = 'executor_phase_a_approval_receipts'
+                      AND constraint_name = ?
+                    ORDER BY ordinal_position
+                `).all(name);
+                if (columns.map((column) => column.name).join(',') === 'tenant_id,workspace_id,task_id,run_id') {
+                    db.exec(`ALTER TABLE executor_phase_a_approval_receipts DROP CONSTRAINT "${name}"`);
+                }
+            }
+        }
+        else {
+            const columns = db.prepare(`PRAGMA table_info(executor_phase_a_approval_receipts)`).all();
+            if (!columns.some((column) => column.name === 'receipt_kind')) {
+                db.transaction(() => db.exec(`
+                    ALTER TABLE executor_phase_a_approval_receipts RENAME TO executor_phase_a_approval_receipts_v1;
+                    CREATE TABLE executor_phase_a_approval_receipts (
+                        receipt_id TEXT PRIMARY KEY,
+                        tenant_id TEXT NOT NULL DEFAULT 'default',
+                        workspace_id TEXT NOT NULL,
+                        task_id TEXT NOT NULL,
+                        task_reference TEXT NOT NULL,
+                        run_id TEXT NOT NULL,
+                        receipt_kind TEXT NOT NULL CHECK (receipt_kind IN ('main', 'cleanup-only')),
+                        original_capability_id TEXT,
+                        residual_inventory_sha256 TEXT,
+                        actor_user_id TEXT NOT NULL,
+                        preflight_sha256 TEXT NOT NULL,
+                        logical_envelope_sha256 TEXT NOT NULL,
+                        canonical_preflight_bytes BLOB NOT NULL,
+                        canonical_receipt_bytes BLOB NOT NULL,
+                        receipt_sha256 TEXT NOT NULL,
+                        key_id TEXT NOT NULL,
+                        approved_at TEXT NOT NULL,
+                        expires_at TEXT NOT NULL,
+                        created_at TEXT NOT NULL,
+                        UNIQUE (tenant_id, workspace_id, task_id, run_id, receipt_kind)
+                    );
+                    INSERT INTO executor_phase_a_approval_receipts (
+                        receipt_id, tenant_id, workspace_id, task_id, task_reference, run_id,
+                        receipt_kind, original_capability_id, residual_inventory_sha256,
+                        actor_user_id, preflight_sha256, logical_envelope_sha256,
+                        canonical_preflight_bytes, canonical_receipt_bytes, receipt_sha256,
+                        key_id, approved_at, expires_at, created_at
+                    )
+                    SELECT receipt_id, tenant_id, workspace_id, task_id, task_reference, run_id,
+                        'main', NULL, NULL, actor_user_id, preflight_sha256, logical_envelope_sha256,
+                        canonical_preflight_bytes, canonical_receipt_bytes, receipt_sha256,
+                        key_id, approved_at, expires_at, created_at
+                    FROM executor_phase_a_approval_receipts_v1;
+                    DROP TABLE executor_phase_a_approval_receipts_v1;
+                `))();
+            }
+        }
+    }
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS executor_phase_a_approval_receipts (
+            receipt_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            task_reference TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            receipt_kind TEXT NOT NULL CHECK (receipt_kind IN ('main', 'cleanup-only')),
+            original_capability_id TEXT,
+            residual_inventory_sha256 TEXT,
+            actor_user_id TEXT NOT NULL,
+            preflight_sha256 TEXT NOT NULL,
+            logical_envelope_sha256 TEXT NOT NULL,
+            canonical_preflight_bytes ${bytesType} NOT NULL,
+            canonical_receipt_bytes ${bytesType} NOT NULL,
+            receipt_sha256 TEXT NOT NULL,
+            key_id TEXT NOT NULL,
+            approved_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            UNIQUE (tenant_id, workspace_id, task_id, run_id, receipt_kind)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_receipts_scope
+        ON executor_phase_a_approval_receipts(tenant_id, workspace_id, task_id, approved_at);
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_executor_phase_a_receipts_run_kind
+        ON executor_phase_a_approval_receipts(tenant_id, workspace_id, task_id, run_id, receipt_kind);
+    `);
+}
+export function ensureExecutorPhaseARunAuthorizationsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS executor_phase_a_run_capabilities (
+            capability_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            receipt_id TEXT NOT NULL,
+            receipt_sha256 TEXT NOT NULL,
+            capability_kind TEXT NOT NULL CHECK (capability_kind IN ('main', 'cleanup-only')),
+            original_capability_id TEXT,
+            residual_inventory_sha256 TEXT,
+            actor_user_id TEXT NOT NULL,
+            account_id TEXT NOT NULL,
+            region TEXT NOT NULL,
+            availability_zone TEXT NOT NULL,
+            read_principal_arn TEXT NOT NULL,
+            broker_key_fingerprint TEXT NOT NULL,
+            capability_sha256 TEXT NOT NULL,
+            preflight_sha256 TEXT NOT NULL,
+            logical_envelope_sha256 TEXT NOT NULL,
+            source_commit TEXT NOT NULL,
+            role_map_sha256 TEXT NOT NULL,
+            oidc_audience_sha256 TEXT NOT NULL,
+            issued_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            mutation_deadline TEXT NOT NULL,
+            cleanup_deadline TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (status IN (
+                'active', 'awaiting-cleanup-approval', 'completed', 'cleanup-failed', 'expired'
+            )),
+            hard_stopped_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, workspace_id, task_id, run_id, receipt_id, broker_key_fingerprint),
+            UNIQUE (tenant_id, receipt_id),
+            UNIQUE (tenant_id, original_capability_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_run_capabilities_scope
+        ON executor_phase_a_run_capabilities(tenant_id, workspace_id, task_id, run_id, status);
+
+        CREATE TABLE IF NOT EXISTS executor_phase_a_sender_nonces (
+            nonce_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            capability_id TEXT NOT NULL,
+            request_sha256 TEXT NOT NULL,
+            phase TEXT NOT NULL CHECK (phase IN ('bootstrap', 'ami-build', 'provenance', 'runtime', 'cleanup')),
+            issued_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            consumed_at TEXT,
+            status TEXT NOT NULL CHECK (status IN ('issued', 'consumed', 'revoked', 'expired')),
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, capability_id, nonce_id),
+            FOREIGN KEY (capability_id) REFERENCES executor_phase_a_run_capabilities(capability_id) ON DELETE RESTRICT
+        );
+
+        CREATE TABLE IF NOT EXISTS executor_phase_a_workload_grants (
+            grant_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            capability_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            receipt_id TEXT NOT NULL,
+            phase TEXT NOT NULL CHECK (phase IN ('bootstrap', 'ami-build', 'provenance', 'runtime', 'cleanup')),
+            role_arn TEXT NOT NULL,
+            grant_sha256 TEXT NOT NULL,
+            token_id TEXT NOT NULL,
+            nonce_id TEXT NOT NULL,
+            sender_proof_sha256 TEXT NOT NULL,
+            broker_key_fingerprint TEXT NOT NULL,
+            source_identity TEXT NOT NULL,
+            session_tags_sha256 TEXT NOT NULL,
+            policy_sha256 TEXT NOT NULL,
+            issued_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            used_at TEXT,
+            status TEXT NOT NULL CHECK (status IN ('issued', 'used', 'revoked', 'rejected', 'expired')),
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, token_id),
+            UNIQUE (tenant_id, capability_id, nonce_id),
+            UNIQUE (tenant_id, capability_id, sender_proof_sha256),
+            FOREIGN KEY (capability_id) REFERENCES executor_phase_a_run_capabilities(capability_id) ON DELETE RESTRICT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_workload_grants_scope
+        ON executor_phase_a_workload_grants(tenant_id, capability_id, phase, status, issued_at);
+
+        CREATE TABLE IF NOT EXISTS executor_phase_a_issuer_redemptions (
+            request_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            grant_id TEXT NOT NULL,
+            grant_sha256 TEXT NOT NULL,
+            sender_proof_sha256 TEXT NOT NULL,
+            request_sha256 TEXT NOT NULL,
+            canonical_response_bytes ${db.provider === 'postgres' ? 'BYTEA' : 'BLOB'} NOT NULL,
+            response_sha256 TEXT NOT NULL,
+            redeemed_at TEXT NOT NULL,
+            UNIQUE (tenant_id, grant_id),
+            FOREIGN KEY (grant_id) REFERENCES executor_phase_a_workload_grants(grant_id) ON DELETE RESTRICT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_issuer_redemptions_grant
+        ON executor_phase_a_issuer_redemptions(tenant_id, grant_id, redeemed_at);
+    `);
+}
 export function ensureAgentRolesSchema(db) {
     db.exec(`
         CREATE TABLE IF NOT EXISTS agent_roles (

package/dist/runtime/appGates.d.ts

@@ -1,4 +1,4 @@
-import type { TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { type TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
 import { APP_GATE_DEFINITIONS as APP_GATE_CONFIG } from './appGateDefinitions.js';
 export declare const ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY: "annotated_attachments.workspace_access";
 export declare const DOCUMENT_WORKSPACE_FEATURE_KEY: "documents.workspace_access";
@@ -26,4 +26,5 @@ export declare function listAppGateDefinitions(): AppGateDefinition[];
 export declare function getAppGateDefinition(featureKey: string): AppGateDefinition | null;
 export declare function resolveAppGateAccess(featureKey: string, environment: TaskforceCloudEnvironment): ResolvedFeatureAccess;
 export declare function resolveAppGateAccessMap(environment: TaskforceCloudEnvironment): ResolvedFeatureAccessMap;
+export declare function resolveClientAppGateAccessMap(accessMap: ResolvedFeatureAccessMap | null | undefined, cloudEnvironment: unknown): ResolvedFeatureAccessMap;
 export declare function isResolvedFeatureAccessMap(value: unknown): value is ResolvedFeatureAccessMap;

package/dist/runtime/appGates.js

@@ -1,3 +1,4 @@
+import { parseTaskforceCloudEnvironment, } from '../config/cloudEnvironment.js';
 import { APP_GATE_DEFINITIONS as APP_GATE_CONFIG } from './appGateDefinitions.js';
 export const ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY = 'annotated_attachments.workspace_access';
 export const DOCUMENT_WORKSPACE_FEATURE_KEY = 'documents.workspace_access';
@@ -53,6 +54,12 @@ export function resolveAppGateAccess(featureKey, environment) {
 export function resolveAppGateAccessMap(environment) {
     return Object.fromEntries(listAppGateDefinitions().map(({ key }) => [key, resolveAppGateAccess(key, environment)]));
 }
+export function resolveClientAppGateAccessMap(accessMap, cloudEnvironment) {
+    if (accessMap && isResolvedFeatureAccessMap(accessMap))
+        return accessMap;
+    const environment = parseTaskforceCloudEnvironment(String(cloudEnvironment || '')) || 'production';
+    return resolveAppGateAccessMap(environment);
+}
 export function isResolvedFeatureAccessMap(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;

package/dist/server/buildInfo.d.ts

@@ -3,5 +3,6 @@ export interface TaskforceBuildInfo {
     gitSha: string | null;
     buildTime: string | null;
     deployId: string | null;
+    environmentId: string | null;
 }
 export declare function resolveBuildInfo(env?: NodeJS.ProcessEnv): TaskforceBuildInfo;

package/dist/server/buildInfo.js

@@ -88,6 +88,9 @@ export function resolveBuildInfo(env = process.env) {
         env.CF_PAGES_URL,
         env.GITHUB_RUN_ID
     ]);
+    const environmentId = resolveFirstNonEmpty([
+        env.RAILWAY_ENVIRONMENT_ID,
+    ]);
     const version = explicitVersion
         ? explicitVersion
         : appendBuildMetadata(packageVersion, [deployId, gitSha, buildTimeToken(buildTime)]);
@@ -95,6 +98,7 @@ export function resolveBuildInfo(env = process.env) {
         version,
         gitSha,
         buildTime,
-        deployId
+        deployId,
+        environmentId,
     };
 }

package/dist/server/cloudMcpCapacityTelemetry.d.ts

@@ -0,0 +1,68 @@
+import type { ServerResponse } from 'node:http';
+import type { RequestPerformanceDiagnostics } from '../storage/postgresRequestDiagnostics.js';
+export declare const TASKFORCE_CAPACITY_TRACE_HEADER = "x-taskforce-capacity-trace";
+export type CloudMcpRequestClass = 'initialize' | 'discover' | 'tools_list' | 'read' | 'write' | 'other';
+export type CloudMcpOutcome = 'success' | 'rejected' | 'client_error' | 'server_error' | 'timeout_or_abort';
+export type CloudMcpRejectionClass = 'rate_limited' | 'auth_or_scope' | 'protocol' | 'other_client';
+type EventLoopSampler = {
+    enable(): void;
+    disable?(): void;
+    reset(): void;
+    percentile(percentile: number): number;
+    readonly max: number;
+};
+type CapacityTelemetryOptions = {
+    emit?: (payload: Record<string, unknown>) => void;
+    eventLoop?: EventLoopSampler;
+    now?: () => number;
+    cpuUsage?: typeof process.cpuUsage;
+    memoryUsage?: typeof process.memoryUsage;
+    windowMs?: number;
+    maxSamples?: number;
+};
+export declare class CloudMcpCapacityTelemetry {
+    private readonly emit;
+    private readonly eventLoop;
+    private readonly now;
+    private readonly cpuUsage;
+    private readonly memoryUsage;
+    private readonly windowMs;
+    private readonly maxSamples;
+    private activeRequests;
+    private maxActiveRequests;
+    private samples;
+    private completedRequests;
+    private requestClassCounts;
+    private outcomeCounts;
+    private rejectionCounts;
+    private statusClassCounts;
+    private windowStartedAt;
+    private windowCpuStartedAt;
+    private readonly flushTimer;
+    constructor(options?: CapacityTelemetryOptions);
+    begin(requestClass?: CloudMcpRequestClass): {
+        classify: (nextClass: CloudMcpRequestClass) => void;
+        setTraceHeaders: (res: ServerResponse, postgres?: RequestPerformanceDiagnostics | null) => void;
+        finish: (input: {
+            statusCode: number;
+            aborted?: boolean;
+            postgres?: RequestPerformanceDiagnostics | null;
+        }) => void;
+    };
+    snapshot(): Record<string, unknown>;
+    flush(): Record<string, unknown> | null;
+    shutdown(): void;
+    private flushIfDue;
+    private minimumPoolIdle;
+}
+export declare function isCloudMcpCapacityTelemetryEnabled(): boolean;
+export declare function beginCloudMcpCapacityRequest(requestClass?: CloudMcpRequestClass): {
+    classify: (nextClass: CloudMcpRequestClass) => void;
+    setTraceHeaders: (res: ServerResponse, postgres?: RequestPerformanceDiagnostics | null) => void;
+    finish: (input: {
+        statusCode: number;
+        aborted?: boolean;
+        postgres?: RequestPerformanceDiagnostics | null;
+    }) => void;
+};
+export {};